Windows Analysis Report
http://sender-004.cafe24.com/filter/

Overview

General Information

Sample URL:	http://sender-004.cafe24.com/filter/
Analysis ID:	1430948
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Source: http://sender-004.cafe24.com/filter/

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49730 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49727 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49730 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /filter/ HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/body.css HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/line01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error_adress.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/botton_home.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/copyright02.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/bg01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/line01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/botton_home.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error_adress.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/copyright02.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/bg01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.html HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/login.jsp HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://sender-004.cafe24.com/index.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: sender-004.cafe24.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713953692707&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Resin/2.1.16Cache-Control: no-cacheExpires: Thu, 01 Dec 1994 16:00:00 GMTContent-Type: text/html;charset=euc-krContent-Length: 3709Date: Wed, 24 Apr 2024 10:15:07 GMTData Raw: 0d 0a 3c 48 54 4d 4c 3e 0d 0a 3c 48 45 41 44 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e 54 68 75 6e 64 65 72 4d 61 69 6c 34 2e 35 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 6b 73 5f 63 5f 35 36 30 31 2d 31 39 38 37 22 3e 0d 0a 3c 4c 49 4e 4b 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 64 79 2e 63 73 73 22 20 74 79 70 65 3d 74 65 78 74 2f 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 63 6f 6e 74 65 6e 74 3d 22 4d 53 48 54 4d 4c 20 36 2e 30 30 2e 32 38 30 30 2e 31 31 30 36 22 20 6e 61 6d 65 3d 47 45 4e 45 52 41 54 4f 52 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 6c 65 66 74 4d 61 72 67 69 6e 3d 30 20 74 6f 70 4d 61 72 67 69 6e 3d 30 20 73 63 72 6f 6c 6c 62 61 72 73 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 0d 0a 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 68 65 69 67 68 74 3d 31 30 30 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 61 63 6b 67 72 6f 75 6e 64 3d 2f 69 6d 61 67 65 2f 65 72 72 6f 72 2f 62 67 30 31 2e 67 69 66 20 0d 0a 20 20 68 65 69 67 68 74 3d 35 34 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 3c 2f 54 42 4f 44 59 3e 3c 2f 54 41 42 4c 45 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 76 41 6c 69 67 6e 3d 74 6f 70 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 67 43 6f 6c 6f 72 3d 23 66 61 66 61 66 61 3e 0d 0a 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 35 35 30 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 77 69 64 74 68 3d 36 30 30 20 68 65 69 67 68 74 3d 31 30 3e 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Resin/2.1.16Cache-Control: no-cacheExpires: Thu, 01 Dec 1994 16:00:00 GMTContent-Type: text/html;charset=euc-krContent-Length: 3709Date: Wed, 24 Apr 2024 10:15:08 GMTData Raw: 0d 0a 3c 48 54 4d 4c 3e 0d 0a 3c 48 45 41 44 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e 54 68 75 6e 64 65 72 4d 61 69 6c 34 2e 35 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 6b 73 5f 63 5f 35 36 30 31 2d 31 39 38 37 22 3e 0d 0a 3c 4c 49 4e 4b 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 64 79 2e 63 73 73 22 20 74 79 70 65 3d 74 65 78 74 2f 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 63 6f 6e 74 65 6e 74 3d 22 4d 53 48 54 4d 4c 20 36 2e 30 30 2e 32 38 30 30 2e 31 31 30 36 22 20 6e 61 6d 65 3d 47 45 4e 45 52 41 54 4f 52 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 6c 65 66 74 4d 61 72 67 69 6e 3d 30 20 74 6f 70 4d 61 72 67 69 6e 3d 30 20 73 63 72 6f 6c 6c 62 61 72 73 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 0d 0a 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 68 65 69 67 68 74 3d 31 30 30 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 61 63 6b 67 72 6f 75 6e 64 3d 2f 69 6d 61 67 65 2f 65 72 72 6f 72 2f 62 67 30 31 2e 67 69 66 20 0d 0a 20 20 68 65 69 67 68 74 3d 35 34 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 3c 2f 54 42 4f 44 59 3e 3c 2f 54 41 42 4c 45 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 76 41 6c 69 67 6e 3d 74 6f 70 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 67 43 6f 6c 6f 72 3d 23 66 61 66 61 66 61 3e 0d 0a 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 35 35 30 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 77 69 64 74 68 3d 36 30 30 20 68 65 69 67 68 74 3d 31 30 3e 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49727 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/34@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2228,i,3603984539344197173,3474500485459397694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://sender-004.cafe24.com/filter/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2228,i,3603984539344197173,3474500485459397694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.101.103	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
218.236.58.151	sender-004.cafe24.com	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
www.google.com	142.250.101.103	true
sender-004.cafe24.com	218.236.58.151	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Reputation
http://sender-004.cafe24.com/css/body.css	false	high
http://sender-004.cafe24.com/image/error/copyright02.gif	false	high
http://sender-004.cafe24.com/image/error/bg01.gif	false	high
http://sender-004.cafe24.com/image/error/botton_home.gif	false	high
http://sender-004.cafe24.com/filter/	false	high
http://sender-004.cafe24.com/login/login.jsp	false	high
http://sender-004.cafe24.com/index.html	false	high
http://sender-004.cafe24.com/favicon.ico	false	high
http://sender-004.cafe24.com/image/error/error.gif	false	high
http://sender-004.cafe24.com/image/error/line01.gif	false	high
http://sender-004.cafe24.com/image/error/error_adress.gif	false	high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:15:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	38716B60A28D29BE74125A357DB095F1	880584364988C7AB2942A7798F876791EA51F5B3	71DD8B890BE56B706517A4908781D9D7ADBF14A2581E45B503735E51474A914C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:15:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	506C94C5221C93E340A46B06F833751B	6CE265A8DA1F431B0A3CBBCE8896CB6FEFA0FD25	245AA48B40913A15E91397FAADD1ED2FBC2CD4E87E42B70D6982D53A21D9860F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9C37E545DBDA6A259A46880694ABAE94	13C18E07E64F622AE90AAD6C815EDAF74D6B1BB2	B48DAC8F524B88266DBD6A2DE338D4501474B0158CEF926379DAD485384944D0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:15:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	82316791B7EB473953194B17ECB4935A	8DEC1B0879984B3FAD8A03A35510F64EBC5EA746	6F8BF50EABAC6D7BF5C23B2345F8A407D031A9195E23F0851355B3C7FEB0BB29
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:15:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	49E144CA3D362556624237E623773583	482D1FBE1F6BB9789454BEE1ABF4405FC839A73B	2F376179C9EA1A703C399AF16ADEBC95E1F8924B1ABD9A9002E0526711A84823
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:15:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C7346BACE4C126ABF5D97D5C48661743	C2A0878490744A008EEA31D929C051F562402CFE	83BEDE53CACFEFA3C68C54EBF33ED3E29FCB5EC8C826A6A0A3442F3BB6658D92
Chrome Cache Entry: 60	GIF image data, version 89a, 47 x 21	59CC379C6DAE64566151B76B13AE5013	B2459987339C02F288F16816C56D63DFDAB7FF83	6BF0D869D11ED17CADDD102DE991B7B9EB9E0A01D183F01A684DEE833593593C
Chrome Cache Entry: 61	GIF image data, version 89a, 85 x 54	6258088CDE6C1A593D5602072A2F6EC0	A6CE2CA69CE87940F1607900CB026400882793A9	F1780F6CFF4387E0C7147E2FA8C0099A96A57F07D1DCC8DB58F9DE4036B02389
Chrome Cache Entry: 62	GIF image data, version 89a, 500 x 20	8FFFB3039CDDA13FD5CF1B62F26429F7	AFF6CFD2E42AE242C66FBAD4ACF47D6857908C3A	44B87D550D76250C26085F4C923AF783819345C41151A21CBA52958628645782
Chrome Cache Entry: 63	GIF image data, version 89a, 47 x 21	59CC379C6DAE64566151B76B13AE5013	B2459987339C02F288F16816C56D63DFDAB7FF83	6BF0D869D11ED17CADDD102DE991B7B9EB9E0A01D183F01A684DEE833593593C
Chrome Cache Entry: 64	GIF image data, version 89a, 420 x 50	36C6F7354811F0F681716543DF381646	9F46E7656E291DF3CA6FF768658B454BF572E212	B4CC3924814D5658194075B98A569005D90D7F78DDC888EC01405A0F572D1989
Chrome Cache Entry: 65	GIF image data, version 89a, 1 x 61	ACECA2A4B4A87AAE466F16C711306649	7ED277E100148F5DB95CE04BFBEE1B49AE4ED284	66D97F18342C49919C3D5A9D042370AAAE0DE52FDC1C6D8BE2EEEC08E9A7D3E6
Chrome Cache Entry: 66	GIF image data, version 89a, 420 x 50	36C6F7354811F0F681716543DF381646	9F46E7656E291DF3CA6FF768658B454BF572E212	B4CC3924814D5658194075B98A569005D90D7F78DDC888EC01405A0F572D1989
Chrome Cache Entry: 67	GIF image data, version 89a, 85 x 54	6258088CDE6C1A593D5602072A2F6EC0	A6CE2CA69CE87940F1607900CB026400882793A9	F1780F6CFF4387E0C7147E2FA8C0099A96A57F07D1DCC8DB58F9DE4036B02389
Chrome Cache Entry: 68	GIF image data, version 89a, 52 x 53	38BA6218471F6FAA98F060D924184258	9CA1491E88B0DB52892D6701C075860A24EF276E	91AA50FE38EAD6CEE9FBD048B674D26FCF0BBE64336893F7A516B22431CE8934
Chrome Cache Entry: 69	ISO-8859 text, with CRLF line terminators	722892208CCA7B046D9DEF0814EEE4C8	79702089209CF396DE73F5B7A3CEC02E6AF3FC2E	A421C3448F2662687F614B9FB4D56E6E11AC902998A039BABA6060DB194F1563
Chrome Cache Entry: 70	HTML document, ISO-8859 text, with CRLF line terminators	D343B1EE9D51DE11734059B9DC77880C	D06E61952A56D5A61C96DCD2D81EA718D688186C	5AB4631A2EE861D561D8A193035BA5113CA239C44F44F0A495D7B156D6B42595
Chrome Cache Entry: 71	ISO-8859 text, with CRLF line terminators	0D301E7BE192EAE0E71636674DBDFF5E	96E85C516C338E91139FC6C24EB8997F37EF963D	A783B850FBCF1526BB21F765167A8ED24F72D38DEA2A243E75F30E1F4496F840
Chrome Cache Entry: 72	HTML document, ISO-8859 text, with CRLF line terminators	D343B1EE9D51DE11734059B9DC77880C	D06E61952A56D5A61C96DCD2D81EA718D688186C	5AB4631A2EE861D561D8A193035BA5113CA239C44F44F0A495D7B156D6B42595
Chrome Cache Entry: 73	GIF image data, version 89a, 52 x 53	38BA6218471F6FAA98F060D924184258	9CA1491E88B0DB52892D6701C075860A24EF276E	91AA50FE38EAD6CEE9FBD048B674D26FCF0BBE64336893F7A516B22431CE8934
Chrome Cache Entry: 74	GIF image data, version 89a, 1 x 61	ACECA2A4B4A87AAE466F16C711306649	7ED277E100148F5DB95CE04BFBEE1B49AE4ED284	66D97F18342C49919C3D5A9D042370AAAE0DE52FDC1C6D8BE2EEEC08E9A7D3E6
Chrome Cache Entry: 75	HTML document, ISO-8859 text, with CRLF line terminators	95A1CEE0D89D490F4EFF01753F1B161F	3C3AB2EB5AC2848104FB5510AA3E06A43822E72C	0D4355252E4481C66FB5188979EC22CA3D34E908B035D37F3A3BFB2405DE5E41
Chrome Cache Entry: 76	GIF image data, version 89a, 500 x 20	8FFFB3039CDDA13FD5CF1B62F26429F7	AFF6CFD2E42AE242C66FBAD4ACF47D6857908C3A	44B87D550D76250C26085F4C923AF783819345C41151A21CBA52958628645782

Source: http://sender-004.cafe24.com/filter/

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49730 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49727 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49730 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /filter/ HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/body.css HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/line01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error_adress.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/botton_home.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/copyright02.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/bg01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/line01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/botton_home.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://sender-004.cafe24.com/filter/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/error_adress.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/copyright02.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /image/error/bg01.gif HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.html HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/login.jsp HTTP/1.1Host: sender-004.cafe24.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://sender-004.cafe24.com/index.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: sender-004.cafe24.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Resin/2.1.16Cache-Control: no-cacheExpires: Thu, 01 Dec 1994 16:00:00 GMTContent-Type: text/html;charset=euc-krContent-Length: 3709Date: Wed, 24 Apr 2024 10:15:07 GMTData Raw: 0d 0a 3c 48 54 4d 4c 3e 0d 0a 3c 48 45 41 44 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e 54 68 75 6e 64 65 72 4d 61 69 6c 34 2e 35 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 6b 73 5f 63 5f 35 36 30 31 2d 31 39 38 37 22 3e 0d 0a 3c 4c 49 4e 4b 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 64 79 2e 63 73 73 22 20 74 79 70 65 3d 74 65 78 74 2f 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 63 6f 6e 74 65 6e 74 3d 22 4d 53 48 54 4d 4c 20 36 2e 30 30 2e 32 38 30 30 2e 31 31 30 36 22 20 6e 61 6d 65 3d 47 45 4e 45 52 41 54 4f 52 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 6c 65 66 74 4d 61 72 67 69 6e 3d 30 20 74 6f 70 4d 61 72 67 69 6e 3d 30 20 73 63 72 6f 6c 6c 62 61 72 73 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 0d 0a 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 68 65 69 67 68 74 3d 31 30 30 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 61 63 6b 67 72 6f 75 6e 64 3d 2f 69 6d 61 67 65 2f 65 72 72 6f 72 2f 62 67 30 31 2e 67 69 66 20 0d 0a 20 20 68 65 69 67 68 74 3d 35 34 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 3c 2f 54 42 4f 44 59 3e 3c 2f 54 41 42 4c 45 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 76 41 6c 69 67 6e 3d 74 6f 70 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 67 43 6f 6c 6f 72 3d 23 66 61 66 61 66 61 3e 0d 0a 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 35 35 30 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 77 69 64 74 68 3d 36 30 30 20 68 65 69 67 68 74 3d 31 30 3e 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Resin/2.1.16Cache-Control: no-cacheExpires: Thu, 01 Dec 1994 16:00:00 GMTContent-Type: text/html;charset=euc-krContent-Length: 3709Date: Wed, 24 Apr 2024 10:15:08 GMTData Raw: 0d 0a 3c 48 54 4d 4c 3e 0d 0a 3c 48 45 41 44 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e 54 68 75 6e 64 65 72 4d 61 69 6c 34 2e 35 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 6b 73 5f 63 5f 35 36 30 31 2d 31 39 38 37 22 3e 0d 0a 3c 4c 49 4e 4b 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 64 79 2e 63 73 73 22 20 74 79 70 65 3d 74 65 78 74 2f 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 0d 0a 0d 0a 3c 4d 45 54 41 20 63 6f 6e 74 65 6e 74 3d 22 4d 53 48 54 4d 4c 20 36 2e 30 30 2e 32 38 30 30 2e 31 31 30 36 22 20 6e 61 6d 65 3d 47 45 4e 45 52 41 54 4f 52 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 6c 65 66 74 4d 61 72 67 69 6e 3d 30 20 74 6f 70 4d 61 72 67 69 6e 3d 30 20 73 63 72 6f 6c 6c 62 61 72 73 3d 22 6e 6f 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 22 20 0d 0a 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 22 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 68 65 69 67 68 74 3d 31 30 30 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 61 63 6b 67 72 6f 75 6e 64 3d 2f 69 6d 61 67 65 2f 65 72 72 6f 72 2f 62 67 30 31 2e 67 69 66 20 0d 0a 20 20 68 65 69 67 68 74 3d 35 34 3e 26 6e 62 73 70 3b 3c 2f 54 44 3e 3c 2f 54 52 3e 3c 2f 54 42 4f 44 59 3e 3c 2f 54 41 42 4c 45 3e 0d 0a 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 3c 54 52 3e 0d 0a 20 20 20 20 3c 54 44 20 76 41 6c 69 67 6e 3d 74 6f 70 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 20 62 67 43 6f 6c 6f 72 3d 23 66 61 66 61 66 61 3e 0d 0a 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67 3d 30 20 77 69 64 74 68 3d 35 35 30 20 62 6f 72 64 65 72 3d 30 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 42 4f 44 59 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 77 69 64 74 68 3d 36 30 30 20 68 65 69 67 68 74 3d 31 30 3e 3c 2f 54 44 3e 3c 2f 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 54 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 54 44 20 61 6c 69 67 6e 3d 6d 69 64 64 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 54 41 42 4c 45 20 63 65 6c 6c 53 70 61 63 69 6e 67 3d 30 20 63 65 6c 6c 50 61 64 64 69 6e 67

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.5:49727 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/34@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2228,i,3603984539344197173,3474500485459397694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://sender-004.cafe24.com/filter/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2228,i,3603984539344197173,3474500485459397694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1430948
Product:	CloudBasic
Start time:	12:14:16
Start date:	24.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://sender-004.cafe24.com/filter/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://sender-004.cafe24.com/filter/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://sender-004.cafe24.com/filter/